CVE-2025-11666: Tenda RP3 Pro Firmware Update force_upgrade.sh hard-coded password
A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file forceupgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument currentforceupgradepwd can lead to use of hard-coded password. The attack can only be executed locally. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11666?
The severity of CVE-2025-11666 has not been explicitly rated, but it is classified as a critical vulnerability due to the use of hard-coded passwords.
How do I fix CVE-2025-11666?
To fix CVE-2025-11666, update the Tenda RP3 Pro firmware to a version newer than 22.5.7.93.
Who is affected by CVE-2025-11666?
CVE-2025-11666 affects users of Tenda RP3 Pro devices running firmware version up to and including 22.5.7.93.
What impact does CVE-2025-11666 have on affected devices?
CVE-2025-11666 allows attackers to leverage a hard-coded password vulnerability in the firmware update handler, potentially compromising the device.
What component is vulnerable in CVE-2025-11666?
The vulnerable component in CVE-2025-11666 is the firmware update handler, specifically the file force_upgrade.sh.